CVE-2018-25145

MEDIUM

Microhard Systems IPn4G 1.1.0 - Info Disclosure

Title source: llm

Description

Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configuration files. Attackers can retrieve configuration files from multiple directories including '/www', '/etc/m_cli/', and '/tmp' to access system passwords and network settings.

Exploits (1)

exploitdb WORKING POC

by LiquidWorm · textwebappshardware

https://www.exploit-db.com/exploits/45036

View Code ZIP pw:eip

References (3)

[Product] http://www.microhardcorp.com

[Exploit] https://www.exploit-db.com/exploits/45036

[Exploit, Third Party Advisory] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5484.php

Scores

CVSS v3 6.5

EPSS 0.0004

EPSS Percentile 13.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-552

Status published

Affected Products (15)

microhardcorp/ipn4g_firmware

microhardcorp/ipn3gb_firmware

microhardcorp/ipn4gb_firmware

microhardcorp/bullet-3g_firmware

microhardcorp/vip4gb_firmware

microhardcorp/vip4gb_wifi-n_firmware

microhardcorp/bullet-3g_firmware

microhardcorp/bullet-lte_firmware

microhardcorp/ipn3gii_firmware

microhardcorp/ipn4gii_firmware

microhardcorp/bulletplus_firmware

microhardcorp/dragon-lte_firmware

Timeline

Published Dec 24, 2025

Tracked Since Feb 18, 2026